Security impact of using constantize

Question

I'm currently reviewing some Rails controller. That controller takes user input and based on that user input a new object is created like so:

clazz = params[:type].classify.constantize
clazz.new(some_method_which_returns_filtered_params)

I'm concerned with the security of this approach. Are there classes in Ruby which the 'new' method could be used with malicious intent?

For example it might be possible to flood the program with new Symbols causing a denial of service (see http://brakemanscanner.org/docs/warning_types/denial_of_service/).

Answer 1

I'd recommend limiting the values that this code will accept for params[:type], before executing it. Eg with an if block like

if %w(foos bars bazzes).include?(params[:type])
  clazz = params[:type].classify.constantize
  clazz.new(some_method_which_returns_filtered_params)
end

I don't think DOS attacks are a specific problem with doing classify.constantize here: if someone spams your server with requests then that's going to DOS attack you whatever you do in the actual controller.

Preventing DOS attacks is hard. Securing web apps is a massive subject, but in particular you seem to be talking about the area of "sanitizing parameters" here. Have a look at http://guides.rubyonrails.org/security.html

I can't resist linking to this classic XKCD strip: http://xkcd.com/327/